Administer > Best practices for importing RHEL 7 content > Content import using Red Hat subscription management

Content import using Red Hat subscription management

The SA RHN import has been enhanced to support content import from both RHN and RHSM. This allows for content import for RHEL 7 and other Red Hat products using RHSM.

New redhat_import binary

To support content import from RHSM a new binary has been added: redhat_import. This binary is capable of importing from both RHN and RHSM and uses an updated configuration file format (see New Configuration File).

New configuration file

The new redhat_import binary uses a new configuration file format. Users using the new binary file will have to migrate existing configuration files to the new format. The new redhat_import binary does not work with old configuration files.

The new configuration file adds two new sections [RHN] and [RHSM] controlling the import from RHN and RHSM respectively. For more details on the format of the new configuration file see the manual page of redhat_import:

/opt/opsware/rhn_import/bin/redhat_import --manual

A sample configuration file is available at:

/etc/opt/opsware/rhn_import/redhat_import.conf-sample

Entitlement certificates

Red Hat subscriptions provide software entitlements. The actual content is delivered through the Red Hat Content Delivery Network (CDN) or through Red Hat Satellite 6.

In the following sections CDN is used to denote content imported from either Red Hat Content Delivery Network or Satellite 6. When there are specifics to the online portal, Red Hat CDN will be used to denote the difference.

RHSM uses the following X.509 certificates for managing subscriptions:

  • Identity certificate - is issued to a system when the system is registered with the subscription management service. This certificate is used to authenticate and identify the system to the subscription management service.
  • Product certificate - is generated and installed on a system once a product is installed. This certificate contains information about the specific system that the product is installed on (such as its hardware and architecture) and the product name, version, and namespace.
  • Entitlement certificate - contains a list of subscriptions for a system, including information about the products and quantities, content repositories, roles, and different namespaces.

In order to be able to connect to Red Hat CDN or Satellite 6 and download content, redhat_import requires an entitlement certificate from RHSM. This must be available on the SA core where redhat_import is run. redhat_import does not use the identity and product certificates.

The entitlement certificate must be generated on the Red Hat Customer Portal or on the Satellite 6 if you want to import content from the Satellite. The next step is to download the certificate and place it on the SA core.

To generate an entitlement certificate, perform the following steps:

  1. Register a system (unit) :
  • For Red Hat Customer Portal the easiest way to achieve this is to register an offline system by providing the system details on the Red Hat Customer Portal. However, if you already have a suitable system that is registered on the Red Hat Customer Portal you can reuse it.
  • For Red Hat Satellite 6, at the moment of writing this document there was no official way of registering offline systems. In order to proceed to the next step you need to have a suitable system that can be registered to the Satellite server using the subscription_management tool provided by Red Hat.
  1. Attach a subscription to the registered system.
  • The attached subscription is required to cover the Red Hat product(s) that you need to download using redhat_import. For example, if you need to download content for RHEL 7, x86_64, the subscription needs to cover Red Hat Enterprise Linux product.
  • For Red Hat Customer Portal the entitlement certificate is available on the portal.
  • For Satellite 6, the default path for entitlement certificate is /etc/pki/entitlement.  This is available on the system registered with the Satellite server. Usually you will find two .pem files (a public and a private key). You should concatenate this two files into a single .pem file. This will be the entitlement certificate that must be downloaded to the core.

Multiple entitlement certificates

redhat_import supports multiple entitlement certificates. If at some point you need to import content that is not covered by any of the existing entitlement certificates you can generate a new entitlement certificate, covering the required CDN content and add it to the redhat_import configuration file.

No entitlement certificate is required when redhat_import binary is only used to download content from RHN.

As best practice don’t mix entitlements for Red Hat Customer Portal with entitlements for Red Hat Satellite 6.